CVE-2007-0107

WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote attackers to…

published January 9, 2007

CVSS

—

EPSS

12%

Percentile

96.0

In the wild

Unconfirmed

What it is

WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote attackers to bypass SQL injection protection schemes and execute arbitrary SQL commands via multibyte charsets, as demonstrated using UTF-7.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.11712 · 96.0th percentile
Published: 2007-01-09T00:00Z

EPSS history

Timeline

09 JAN 00:00Z
WordPress before 2.0.6, when mbstring is enabled for PHP, decodes alternate character sets after escaping the SQL query, which allows remote attackers to…
cvelistv5